Digital forensics · Lab infrastructure · Training
Evidence that holds up, wherever the matter is heard.
TKM Technologies is an independent digital forensics practice. We examine digital evidence in complex, sensitive and cross-jurisdictional matters and give expert evidence that withstands cross-examination. Through the Private Cloud Lab, we provide fully managed, scalable private-cloud laboratory infrastructure to forensic teams, and we design, build and train in-house forensic capability for organisations that want their own.
Three services
Three ways to work with us, each built for a different client.
Digital forensics and expert witness
You instruct us on a matter. We identify, preserve and examine the evidence and give the expert opinion.
For law firms and counsel, companies and organisations conducting internal investigations or responding to regulators, in-house legal and compliance teams, insolvency practitioners, regulators and law enforcement.Private Cloud Lab
We provide the laboratory as a service: your own logically segregated environment, from infrastructure alone to a fully managed platform. You do the forensic work.
For forensic service providers, in-house forensics and e-discovery teams, and investigation functions that need laboratory capacity without the cost of owning it.Lab design, build and training
You want capability of your own. We design and build forensic laboratories and train examiners, investigators and legal teams — together or separately.
For organisations establishing or upgrading an in-house forensics or e-discovery function, and any team that needs training from practising examiners.Digital forensics and expert witness
Forensic examination, from the routine to the bespoke.
For solicitors and counsel, companies and organisations facing internal investigations, regulatory action or GDPR compliance proceedings, in-house legal and compliance teams, insolvency practitioners, regulators and law enforcement.
From routine examinations to the matters that need careful thought — an unfamiliar workflow, a demanding compliance regime, a complex legal process or a great deal riding on the outcome. We do both, and we specialise in the second.
Computers and servers
Workstations, laptops, servers and virtual machines. Full-disk and targeted acquisition, timeline reconstruction, user attribution, and analysis of data exfiltration and deletion.
Cloud and SaaS
Microsoft 365, Google Workspace, AWS, Azure and collaboration platforms. Defensible collection from the tenant, reconstruction of audit logs and preservation for disclosure.
Mobile and portable devices
Phones, tablets, wearables and other portable devices on iOS, Android and beyond, at logical, file-system and physical levels — including locked and damaged devices, application data and cloud-synchronised artefacts.
Embedded and specialist systems
Industrial controllers, IoT devices, vehicle systems and other non-standard hardware: location, event and user data recovered from systems never designed to give it up.
Expert witness, investigations and litigation support
We take instructions directly from companies and organisations as well as from their legal advisers: internal investigations, employee misconduct and data-exfiltration inquiries, regulatory compliance reviews and enforcement action, and GDPR compliance proceedings including data subject access requests. Where a matter reaches formal proceedings, we provide independent expert reports and oral evidence in civil, criminal, family, regulatory and arbitral forums. We write to the procedural rules of the forum — Civil Procedure Rules Part 35 and Practice Direction 35, Criminal Procedure Rules Part 19 (including rule 19.4), Family Procedure Rules Part 25, the IBA Rules on the Taking of Evidence in International Arbitration and their equivalents in other jurisdictions — and our methods follow ISO/IEC 17025 principles. We act as single joint expert as readily as for one party. Every report is written for the people who will rely on it — a judge, an arbitrator, a regulator, a board or an investigating team — and to withstand challenge from the other side.
- Expert reports, joint statements, rebuttal and review of opposing expert evidence
- Conferences with counsel and case-strategy advice
- Internal investigations, including employee misconduct and data exfiltration
- Regulatory investigations, compliance reviews and enforcement responses
- Imaging under preservation and search orders
- Electronic disclosure and e-discovery support
- Data subject access requests and GDPR compliance proceedings
- Device examinations for insolvency and asset tracing
Who instructs us
Private Cloud Lab
A forensic laboratory of your own — without building one.
For forensic practitioners and teams who carry out their own examinations and need a laboratory to do them in.
The Private Cloud Lab is a forensic laboratory delivered as a service: secure, high-performance, scalable compute and storage on infrastructure we own and operate — not public cloud, not a shared tenancy. Scale it to the matter in hand, and take it at the level that suits you, from infrastructure alone to full environment management.
Data residency tells you where a server is. Data sovereignty tells you whose law reaches it. The Private Cloud Lab answers both.
Choose how much we run.
Three service levels, each delivered as your own logically segregated environment on our private infrastructure. Every level includes everything in the one before it, so you can start where you are and move up as the caseload demands.
Hardware and infrastructure
Dedicated compute and storage in our private environment, with secure remote access and hash-verified evidence stores. You bring the tooling, licences and people, and run the laboratory yourself.
You run it. We keep it running.Infrastructure, tooling and licensing
Everything in Infrastructure, plus the forensic and e-discovery toolchain installed, validated, patched and licensed by us. Your examiners log in to a working laboratory and begin on the evidence.
You run the casework. We run the platform.Fully managed environment
Everything in Platform, with us operating the environment end to end: case-environment provisioning, user and access administration, monitoring, backup, retention and certified destruction — with a named point of contact throughout.
You examine. We manage everything else.Private by default
The Private Cloud Lab is not hosted on public cloud services, and we do not ordinarily place client data on them. Evidence sits on hardware we control, on UK-owned and operated infrastructure, which avoids the additional extraterritorial disclosure exposure that comes with infrastructure controlled by overseas-headquartered cloud providers.
Segregated client environments
Each client's Private Cloud Lab is a separate environment, logically segregated from every other at every layer: independent, secured in its own right and resilient on its own. No shared processing queues, no shared evidence stores and no co-tenants with visibility of your work.
High-performance, scalable compute
Processing nodes sized for large-scale indexing, analysis and review. Scale up for a matter; scale down when it closes.
Scalable evidence storage
Hash-verified ingest, immutable evidence stores and tiered working storage, with retention schedules and certified destruction at case close.
Secure remote access
Multi-factor authentication, role-based access, per-session logging and a complete audit trail. Reviewers, counsel and clients see only what they are cleared to see.
Cloud forensics and secure transfer
Where a matter requires it — evidence held in Microsoft 365, AWS or Google Cloud, or a client platform hosted there — we collect from, transfer to and analyse public cloud data under the same custody controls, with the decision and its rationale recorded.
Tooling and licensing
Industry-standard forensic and e-discovery tooling, installed, validated and maintained. Bring your own licences, or let us provide and manage them as part of the service.
Regulatory alignment
Built for UK and EU GDPR, professional confidentiality obligations and the evidential expectations of courts and regulators, with processes that support ISO/IEC 17025-style quality management.
Predictable cost, fast start
No capital expenditure, no procurement cycle, no egress charges and no surprise invoices. Per-matter or subscription pricing that is straightforward to recover from a client, and a matter can start within days.
| Consideration | Private Cloud Lab | Public cloud lab |
|---|---|---|
| Legal reach | UK-owned and operated; disclosure governed by UK law and process | May also be subject to the provider's home jurisdiction, regardless of the region selected |
| Tenancy | Segregated environment per client: independent, secure and resilient | Multi-tenant by default; isolation depends on configuration |
| Physical location | Known facility, disclosable in evidence | "A region" |
| Egress and storage cost | Flat and predictable | Metered; large evidence sets are expensive to move |
| Who has access | Our own named, vetted staff | Provider operations staff, under the provider's own access controls |
The hosting environment
The Private Cloud Lab runs on our own hardware in UK-owned, UK-operated data centres. We do not publish the location. The facilities are independently certified, and we will take instructing parties through the controls under NDA.
ISO/IEC 27001, 27017 and 27018 · ISO 22301 business continuity · ISO 9001 · ISO 20000-1 · PCI DSS · Cyber Essentials Plus
24/7/365 on-site security · perimeter fencing · photo ID, proximity card and zonal access · HD CCTV with 90-day retention
N+N power and UPS · N+1 generators with 72 hours of fuel · dual feeds to every rack · 100% power and cooling SLA
VESDA early smoke detection · two-stage detection · inert-gas (argon/nitrogen) suppression · N+N free-cooling chillers
Facility certifications are held by the data-centre operator. Our own controls sit above them: dedicated hardware, hash-verified evidence stores, named-staff access and complete audit logging.
Built for
Lab design, build and training
Build the capability you need: a laboratory, trained people or both.
For organisations establishing their own forensics or e-discovery function, and any team that needs digital forensics training from practising examiners.
We have designed, built and run forensic laboratories. We will help you build yours — right-sized, defensible and ready for the work you actually do, with a route to accreditation when you need one. Our training stands on its own: no laboratory project required.
Laboratory design and build
Requirements and scope
The matters you will handle, the people who will use the environment and the courts and regulators who will judge it — and what each implies for the design.
Physical and logical design
Evidence store, examination areas, network segregation and air-gapping, secure remote access and integration with your wider IT estate.
Tooling and validation
Independent selection of forensic and e-discovery platforms, validation and verification plans, and a refresh roadmap that avoids vendor lock-in.
Process and quality
Standard operating procedures, chain-of-custody and exhibit handling, competence frameworks and, where required, a path to ISO/IEC 17025 accreditation.
People
Role design, recruitment support and onboarding, so the laboratory is used well from day one.
Hybrid operation
Keep sensitive work in-house and draw on the Private Cloud Lab for surge or specialist capacity, under a single custody model.
Training
A standalone service, open to any organisation. Delivered by practising examiners at your offices, in our laboratory or online, and built around your casework rather than a generic syllabus.
For legal teams
Digital evidence for solicitors, barristers and in-house counsel: what can be recovered, what it proves, how to instruct an expert and how to challenge one.
For first responders
Identifying, seizing and preserving digital evidence so nothing is lost before the examiner arrives. For investigators, HR, security and IT teams.
For practitioners
Advanced examiner courses on cloud, mobile and embedded-system forensics, and on writing evidence that survives cross-examination.
For in-house laboratories
Competence and onboarding programmes for an existing or newly built environment, aligned to your procedures and tooling, whoever built it.
How we work
Three commitments on every instruction.
Impartial
Our findings are the same whoever instructs us. We report what the evidence shows, clearly and without favour, so that everyone who relies on our work can trust it.
Defensible
Verified acquisition, cryptographic hashing, continuous custody records and reproducible methods, documented so that another examiner could repeat them.
Confidential
Evidence is handled in our own laboratory by named staff. We do not subcontract examinations, and we place client data on public cloud services only where the matter calls for it and the instructing party agrees.
Contact
Tell us about the matter.
Initial conversations are confidential and without obligation. For urgent matters, telephone is the quickest way to reach us.